Remote Code Execution Vulnerability in Cisco ISE Products

CVE-2026-20147

What is CVE-2026-20147?

A vulnerability has been identified in Cisco Identity Services Engine (ISE) and its platform extension Cisco ISE-PIC, allowing an authenticated remote attacker to execute arbitrary commands on the underlying operating system. The flaw arises from inadequate validation of user-supplied input, enabling attackers with valid administrative credentials to send specially crafted HTTP requests to exploit the vulnerability. Successful exploitation grants user-level access to the operating system, with potential elevation to root privileges. In single-node deployments of ISE, this could result in complete unavailability of the ISE node, leading to a denial of service condition that disrupts network access for unauthenticated endpoints until the node is restored. For more detailed information, please refer to the Cisco Security Advisory.

News Articles

The Hacker News

CVE-2026-20147CVE-2026-20180

Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution

Cisco patches four CVEs up to CVSS 9.9 in ISE and Webex, preventing code execution and user impersonation risks.

References